How can I categorise logs by port with rSyslog?Remote rsyslog only writing logging data to /var/log/syslog and not custom logfilesForwarding rsyslog to syslog-ng, with FQDN and facility separationForwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)How can I separate logs with rsyslog from a remote location for devices using the same IP?How can I make rsyslog send the logfiles to a location outside of /var/log?graylog not getting cents 7.1 syslog messages using the rsyslogd serviceHow do I handle messages from my custom application in rsyslog?Rsyslog logs are beeing duplicatedRewriting facility/severity in rsyslog v7 before shipping off to a remote collectorLogrotate Separate Policies in Same Directory
What makes Graph invariants so useful/important?
What is the offset in a seaplane's hull?
What would the Romans have called "sorcery"?
What do you call something that goes against the spirit of the law, but is legal when interpreting the law to the letter?
DOS, create pipe for stdin/stdout of command.com(or 4dos.com) in C or Batch?
How to type dʒ symbol (IPA) on Mac?
Prevent a directory in /tmp from being deleted
Copenhagen passport control - US citizen
Why doesn't Newton's third law mean a person bounces back to where they started when they hit the ground?
Why is this code 6.5x slower with optimizations enabled?
Japan - Plan around max visa duration
How do I create uniquely male characters?
How to make payment on the internet without leaving a money trail?
Why don't electron-positron collisions release infinite energy?
Circuitry of TV splitters
Can a German sentence have two subjects?
Shell script can be run only with sh command
Is it possible to do 50 km distance without any previous training?
Is Social Media Science Fiction?
Infinite past with a beginning?
Banach space and Hilbert space topology
Can an x86 CPU running in real mode be considered to be basically an 8086 CPU?
I probably found a bug with the sudo apt install function
Is there a familial term for apples and pears?
How can I categorise logs by port with rSyslog?
Remote rsyslog only writing logging data to /var/log/syslog and not custom logfilesForwarding rsyslog to syslog-ng, with FQDN and facility separationForwarding from rsyslog to syslog-ng over TCP not working (although packets are reaching server)How can I separate logs with rsyslog from a remote location for devices using the same IP?How can I make rsyslog send the logfiles to a location outside of /var/log?graylog not getting cents 7.1 syslog messages using the rsyslogd serviceHow do I handle messages from my custom application in rsyslog?Rsyslog logs are beeing duplicatedRewriting facility/severity in rsyslog v7 before shipping off to a remote collectorLogrotate Separate Policies in Same Directory
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I've always used Syslog-NG for my logging situations, but my hands are tied and I have to use rsyslog, something I'm not overly familiar with.
I largely understand how to configure it, however, one of the ways I want to do it is to categorise by device type, ie, Linux device logs go into a linux folder, same for windows etc etc.
With Syslog-NG, I was able to do this by having a different port for each device type, and then having Syslog-ng place it in the correct folder by the port.
I can't find a way of doing this is in rsyslog. I've tried templates, but all that's doing is putting everything in the linux folder and everything in the windows folder, essentially duplicating. I've tried with filters, but getting nowhere with that either.
Firstly, does anyone know if its possible to categorise logs this way? And if so, could you point me in the right direction?
rsyslog
asked Apr 4 at 13:48
SlawbSlawb
31
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I've always used Syslog-NG for my logging situations, but my hands are tied and I have to use rsyslog, something I'm not overly familiar with.
I largely understand how to configure it, however, one of the ways I want to do it is to categorise by device type, ie, Linux device logs go into a linux folder, same for windows etc etc.
With Syslog-NG, I was able to do this by having a different port for each device type, and then having Syslog-ng place it in the correct folder by the port.
I can't find a way of doing this is in rsyslog. I've tried templates, but all that's doing is putting everything in the linux folder and everything in the windows folder, essentially duplicating. I've tried with filters, but getting nowhere with that either.
Firstly, does anyone know if its possible to categorise logs this way? And if so, could you point me in the right direction?
rsyslog
asked Apr 4 at 13:48
SlawbSlawb
31
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I've always used Syslog-NG for my logging situations, but my hands are tied and I have to use rsyslog, something I'm not overly familiar with.
I largely understand how to configure it, however, one of the ways I want to do it is to categorise by device type, ie, Linux device logs go into a linux folder, same for windows etc etc.
With Syslog-NG, I was able to do this by having a different port for each device type, and then having Syslog-ng place it in the correct folder by the port.
I can't find a way of doing this is in rsyslog. I've tried templates, but all that's doing is putting everything in the linux folder and everything in the windows folder, essentially duplicating. I've tried with filters, but getting nowhere with that either.
Firstly, does anyone know if its possible to categorise logs this way? And if so, could you point me in the right direction?
rsyslog
asked Apr 4 at 13:48
SlawbSlawb
31
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I've always used Syslog-NG for my logging situations, but my hands are tied and I have to use rsyslog, something I'm not overly familiar with.
I largely understand how to configure it, however, one of the ways I want to do it is to categorise by device type, ie, Linux device logs go into a linux folder, same for windows etc etc.
With Syslog-NG, I was able to do this by having a different port for each device type, and then having Syslog-ng place it in the correct folder by the port.
I can't find a way of doing this is in rsyslog. I've tried templates, but all that's doing is putting everything in the linux folder and everything in the windows folder, essentially duplicating. I've tried with filters, but getting nowhere with that either.
Firstly, does anyone know if its possible to categorise logs this way? And if so, could you point me in the right direction?
rsyslog
rsyslog
asked Apr 4 at 13:48
SlawbSlawb
31
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 4 at 13:48
SlawbSlawb
31
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 4 at 13:48
SlawbSlawb
31
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Apr 4 at 13:48
SlawbSlawb
31
asked Apr 4 at 13:48
SlawbSlawb
31
31
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Slawb is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
If you want to input from a given tcp port to go to one logfile, and from a second tcp port to go to another, check out Multiple Rulesets. The example Split local and remote logging for three different ports cut down to 2 tcp ports 10514 and 10515 gives you:
ruleset(name="remote10514")
action(type="omfile" file="/var/log/fileA")
ruleset(name="remote10515")
action(type="omfile" file="/var/log/fileB")
input(type="imptcp" port="10514" ruleset="remote10514")
input(type="imptcp" port="10515" ruleset="remote10515")
Inside each ruleset()... you can have any usual further filtering and templating.
answered Apr 4 at 14:07
meuhmeuh
48448
Hm, I previously tried something similar but with templates included for file names etc. Maybe I binded the templates wrong. I'll go back to it and try again and then set as answer once I get it working :).
– Slawb
Apr 4 at 14:11
Note that rsyslog has lots of versions, all with differences, so you may find some syntax doesn't work as expected. Add your rsyslog version number to your original question if so. Rulesets came in from versions 4.5.0 and 5.1.1.
– meuh
Apr 4 at 14:44
I got it working perfectly, thanks. A combination of yours worked, a slight change to the ruleset: ruleset(name="remote10515"){ action(type="omfile" DynaFile="RemoteWinTem") Both seem to be working perfectly now. Many thanks :)
– Slawb
Apr 4 at 14:59
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Slawb is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f961508%2fhow-can-i-categorise-logs-by-port-with-rsyslog%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If you want to input from a given tcp port to go to one logfile, and from a second tcp port to go to another, check out Multiple Rulesets. The example Split local and remote logging for three different ports cut down to 2 tcp ports 10514 and 10515 gives you:
ruleset(name="remote10514")
action(type="omfile" file="/var/log/fileA")
ruleset(name="remote10515")
action(type="omfile" file="/var/log/fileB")
input(type="imptcp" port="10514" ruleset="remote10514")
input(type="imptcp" port="10515" ruleset="remote10515")
Inside each ruleset()... you can have any usual further filtering and templating.
answered Apr 4 at 14:07
meuhmeuh
48448
Hm, I previously tried something similar but with templates included for file names etc. Maybe I binded the templates wrong. I'll go back to it and try again and then set as answer once I get it working :).
– Slawb
Apr 4 at 14:11
Note that rsyslog has lots of versions, all with differences, so you may find some syntax doesn't work as expected. Add your rsyslog version number to your original question if so. Rulesets came in from versions 4.5.0 and 5.1.1.
– meuh
Apr 4 at 14:44
I got it working perfectly, thanks. A combination of yours worked, a slight change to the ruleset: ruleset(name="remote10515"){ action(type="omfile" DynaFile="RemoteWinTem") Both seem to be working perfectly now. Many thanks :)
– Slawb
Apr 4 at 14:59
add a comment |
If you want to input from a given tcp port to go to one logfile, and from a second tcp port to go to another, check out Multiple Rulesets. The example Split local and remote logging for three different ports cut down to 2 tcp ports 10514 and 10515 gives you:
ruleset(name="remote10514")
action(type="omfile" file="/var/log/fileA")
ruleset(name="remote10515")
action(type="omfile" file="/var/log/fileB")
input(type="imptcp" port="10514" ruleset="remote10514")
input(type="imptcp" port="10515" ruleset="remote10515")
Inside each ruleset()... you can have any usual further filtering and templating.
answered Apr 4 at 14:07
meuhmeuh
48448
Hm, I previously tried something similar but with templates included for file names etc. Maybe I binded the templates wrong. I'll go back to it and try again and then set as answer once I get it working :).
– Slawb
Apr 4 at 14:11
Note that rsyslog has lots of versions, all with differences, so you may find some syntax doesn't work as expected. Add your rsyslog version number to your original question if so. Rulesets came in from versions 4.5.0 and 5.1.1.
– meuh
Apr 4 at 14:44
I got it working perfectly, thanks. A combination of yours worked, a slight change to the ruleset: ruleset(name="remote10515"){ action(type="omfile" DynaFile="RemoteWinTem") Both seem to be working perfectly now. Many thanks :)
– Slawb
Apr 4 at 14:59
add a comment |
If you want to input from a given tcp port to go to one logfile, and from a second tcp port to go to another, check out Multiple Rulesets. The example Split local and remote logging for three different ports cut down to 2 tcp ports 10514 and 10515 gives you:
ruleset(name="remote10514")
action(type="omfile" file="/var/log/fileA")
ruleset(name="remote10515")
action(type="omfile" file="/var/log/fileB")
input(type="imptcp" port="10514" ruleset="remote10514")
input(type="imptcp" port="10515" ruleset="remote10515")
Inside each ruleset()... you can have any usual further filtering and templating.
answered Apr 4 at 14:07
meuhmeuh
48448
If you want to input from a given tcp port to go to one logfile, and from a second tcp port to go to another, check out Multiple Rulesets. The example Split local and remote logging for three different ports cut down to 2 tcp ports 10514 and 10515 gives you:
ruleset(name="remote10514")
action(type="omfile" file="/var/log/fileA")
ruleset(name="remote10515")
action(type="omfile" file="/var/log/fileB")
input(type="imptcp" port="10514" ruleset="remote10514")
input(type="imptcp" port="10515" ruleset="remote10515")
Inside each ruleset()... you can have any usual further filtering and templating.
answered Apr 4 at 14:07
meuhmeuh
48448
answered Apr 4 at 14:07
meuhmeuh
48448
answered Apr 4 at 14:07
meuhmeuh
48448
answered Apr 4 at 14:07
meuhmeuh
48448
48448
Hm, I previously tried something similar but with templates included for file names etc. Maybe I binded the templates wrong. I'll go back to it and try again and then set as answer once I get it working :).
– Slawb
Apr 4 at 14:11
Note that rsyslog has lots of versions, all with differences, so you may find some syntax doesn't work as expected. Add your rsyslog version number to your original question if so. Rulesets came in from versions 4.5.0 and 5.1.1.
– meuh
Apr 4 at 14:44
I got it working perfectly, thanks. A combination of yours worked, a slight change to the ruleset: ruleset(name="remote10515"){ action(type="omfile" DynaFile="RemoteWinTem") Both seem to be working perfectly now. Many thanks :)
– Slawb
Apr 4 at 14:59
add a comment |
Hm, I previously tried something similar but with templates included for file names etc. Maybe I binded the templates wrong. I'll go back to it and try again and then set as answer once I get it working :).
– Slawb
Apr 4 at 14:11
Note that rsyslog has lots of versions, all with differences, so you may find some syntax doesn't work as expected. Add your rsyslog version number to your original question if so. Rulesets came in from versions 4.5.0 and 5.1.1.
– meuh
Apr 4 at 14:44
I got it working perfectly, thanks. A combination of yours worked, a slight change to the ruleset: ruleset(name="remote10515"){ action(type="omfile" DynaFile="RemoteWinTem") Both seem to be working perfectly now. Many thanks :)
– Slawb
Apr 4 at 14:59
Hm, I previously tried something similar but with templates included for file names etc. Maybe I binded the templates wrong. I'll go back to it and try again and then set as answer once I get it working :).
– Slawb
Apr 4 at 14:11
Hm, I previously tried something similar but with templates included for file names etc. Maybe I binded the templates wrong. I'll go back to it and try again and then set as answer once I get it working :).
– Slawb
Apr 4 at 14:11
Note that rsyslog has lots of versions, all with differences, so you may find some syntax doesn't work as expected. Add your rsyslog version number to your original question if so. Rulesets came in from versions 4.5.0 and 5.1.1.
– meuh
Apr 4 at 14:44
Note that rsyslog has lots of versions, all with differences, so you may find some syntax doesn't work as expected. Add your rsyslog version number to your original question if so. Rulesets came in from versions 4.5.0 and 5.1.1.
– meuh
Apr 4 at 14:44
I got it working perfectly, thanks. A combination of yours worked, a slight change to the ruleset: ruleset(name="remote10515"){ action(type="omfile" DynaFile="RemoteWinTem") Both seem to be working perfectly now. Many thanks :)
– Slawb
Apr 4 at 14:59
I got it working perfectly, thanks. A combination of yours worked, a slight change to the ruleset: ruleset(name="remote10515"){ action(type="omfile" DynaFile="RemoteWinTem") Both seem to be working perfectly now. Many thanks :)
– Slawb
Apr 4 at 14:59
add a comment |
Slawb is a new contributor. Be nice, and check out our Code of Conduct.
Slawb is a new contributor. Be nice, and check out our Code of Conduct.
Slawb is a new contributor. Be nice, and check out our Code of Conduct.
Slawb is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f961508%2fhow-can-i-categorise-logs-by-port-with-rsyslog%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
